Overview

overview

10

Static

static

3

58308fdf87...18.exe

windows7-x64

10

58308fdf87...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    19-05-2024 02:49

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    58308fdf876ee7508cdbb9aa0ede92e3_JaffaCakes118.exe

  • Size

    2.6MB

  • MD5

    58308fdf876ee7508cdbb9aa0ede92e3

  • SHA1

    eba2522a61ffe2751c738a81e574de29d99bcd1b

  • SHA256

    e9ad0d2cc39a1dd7274df0d5215f26f0c5f9638e5b1904c5f4a21ef3d771904a

  • SHA512

    c5244b5c228ee52ed6d1f79753a03597b7b81b42226f4abe6a411cb1915e9096e6d14b30a37d22308d88f8070ce03b37d76bd34b965968705e105a95289314e4

  • SSDEEP

    49152:vfUFLY1XynWjZtnENylA4tKz7Dy+hiEoUU2aWW0CO:HO2ynWNtENylA4tCDZiiU2aH0CO

Score
10/10
sendsafeunregisteredbotnetspam

Malware Config

Extracted

Family

sendsafe

Botnet

UNREGISTERED

C2

91.220.131.38:50005

91.220.131.38:50006
Attributes
  • service_name

    Enterprise Mailing Service

Signatures

  • SendSafe

    SendSafe is a notorious spam tool which then turned into spam botnet.

    spambotnetsendsafe
  • SendSafe payload 5 IoCs
    botnet
  • Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\58308fdf876ee7508cdbb9aa0ede92e3_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\58308fdf876ee7508cdbb9aa0ede92e3_JaffaCakes118.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    PID:1688

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1688-1-0x0000000000900000-0x0000000000AB2000-memory.dmp
    Filesize

    1.7MB

    Download
  • memory/1688-2-0x0000000000400000-0x0000000000692000-memory.dmp
    Filesize

    2.6MB

    Download
  • memory/1688-7-0x0000000000400000-0x0000000000692000-memory.dmp
    Filesize

    2.6MB

    Download
  • memory/1688-0-0x0000000000400000-0x0000000000692000-memory.dmp
    Filesize

    2.6MB

    Download
  • memory/1688-8-0x0000000000400000-0x0000000000692000-memory.dmp
    Filesize

    2.6MB

    Download
  • memory/1688-6-0x0000000000400000-0x0000000000692000-memory.dmp
    Filesize

    2.6MB

    Download
  • memory/1688-4-0x0000000000400000-0x0000000000692000-memory.dmp
    Filesize

    2.6MB

    Download
  • memory/1688-9-0x0000000000401000-0x0000000000560000-memory.dmp
    Filesize

    1.4MB

    Download
  • memory/1688-10-0x0000000000400000-0x0000000000692000-memory.dmp
    Filesize

    2.6MB

    Download